CVE-2026-33531 is a path traversal vulnerability affecting InvenTree, an open-source inventory management system, in versions prior to 1.2.6 and 1.3.0. This medium-severity vulnerability (CVSS 6.5) allows a staff-level user to read arbitrary files from the server filesystem via crafted report template tags, potentially leading to high confidentiality impact. Exploitation requires low privileges and network access, but there is currently no known public exploit code, active exploitation, or significant community discussion. Users are advised to update to InvenTree version 1.2.6, 1.3.0, or above, as no workarounds are available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2.6CPE matchmatch criteria | cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.